CVE-2026-43828

MediumCVSS 6.5/10Last modified Jul 24, 2026

Description

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.

This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-614

Affected software

VendorProductVersions
Apache Software FoundationApache Shiro>= 1.0, <= 2.1.0; >= 3.0.0-alpha-0, <= 3.0.0-alpha-1

References

Timeline

Published
May 25, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-438297.5A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution CVE-2026-438309.8A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands.CVE-2026-438317.5A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code executiCVE-2026-438327.5A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution CVE-2026-438335.3A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution.CVE-2026-438347.5A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code executiCVE-2026-438358.6A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentCVE-2026-438369.3A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.CVE-2026-438377.5A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve codeCVE-2026-438389.2A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.CVE-2026-438398.7A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.CVE-2026-438406.9A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the
CVE-2026-43828: Medium severity, CVSS 6.5 | Vulnix